MiCoalesceFreePages
UINT64 __stdcall MiCoalesceFreePages(UINT64 PageBeingFreed){
_MMPFN *PfnDb;
__int64 v2;
UINT64 v3;
signed __int64 v4;
UINT16 *v5;
unsigned __int64 v6;
unsigned int v7;
__int64 v8;
UINT64 v9;
int v10;
unsigned __int64 v11;
UINT8 *v12;
int v13;
int v14;
char *v15;
unsigned __int64 v16;
char *v17;
unsigned __int64 v18;
UINT64 v19;
_BYTE *v20;
_BYTE *v21;
unsigned __int64 v23;
_QWORD *v24;
UINT64 *v25;
unsigned __int64 v26;
unsigned int v27;
unsigned int v28;
__int64 v29;
unsigned int v30;
__int64 v31;
unsigned int v32;
__int64 v33;
unsigned int v34;
unsigned int v35;
unsigned int v36;
unsigned int v37;
unsigned int v38;
unsigned int v39;
bool v40;
int v41;
unsigned int v42;
__int64 v43;
CHAR v44;
int v45;
__int64 v46;
int v47;
INT64 v48;
unsigned int i;
unsigned __int64 v50;
INT64 v51;
__int64 v52;
WORK_QUEUE_TYPE v53;
PVOID v54;
__int64 v55;
INT64 v56;
INT64 v57;
INT64 v58;
int v59;
unsigned int v60;
unsigned int v61;
PVOID Lock;
UINT16 *v63;
INT64 a1[2];
__int64 v65;
__int64 v66;
INT64 v67;
__int64 v68;
struct _IO_WORKITEM LockHandle;
memset(&LockHandle, 0, 24);
if( !MmPhysicalMemoryBlock )
return 0i64;
PfnDb = MmGetPfnDb();
v2 = (__int64)PfnDb + 48 * PageBeingFreed;
v3 = PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64;
v68 = v2;
v67 = PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64;
v60 = *(_BYTE *)(v2 + 34) & 7;
v4 = 48 * (PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64);
v5 = *(UINT16 **)(qword_140C4E388 + 8 * ((*(_QWORD *)(v2 + 40) >> 39) & 0x3FFi64));
v63 = v5;
v6 = (unsigned __int64)PfnDb + v4;
v66 = (__int64)PfnDb + v4;
v7 = 0;
v8 = (__int64)PfnDb + v4 + 768;
v9 = PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64;
v10 = dword_140C4DBC8;
v11 = v4 / 48;
if( dword_140C4DBC4 > (unsigned int)dword_140C4DBC8
|| (v12 = &qword_140C4DC08[16 * dword_140C4DBC4], v11 < *(_QWORD *)v12)
|| dword_140C4DBC4 != dword_140C4DBC8 && v11 >= *((_QWORD *)v12 + 2) )
{
v13 = 0;
if( dword_140C4DBC8 < 0 )
LABEL_103:
KeBugCheckEx(0x1Au, 0x6201ui64, v11, 0i64, 0i64);
while( 1 )
{
v14 = (v13 + v10) >> 1;
v12 = &qword_140C4DC08[16 * v14];
if( v11 >= *(_QWORD *)v12 )
{
if( v14 == dword_140C4DBC8 || v11 < *((_QWORD *)v12 + 2) )
{
dword_140C4DBC4 = (v13 + v10) >> 1;
break;
}
v13 = v14 + 1;
}
else
{
if( !v14 )
KeBugCheckEx(0x1Au, 0x6200ui64, v11, (ULONG_PTR)qword_140C4DC08, 0i64);
v10 = v14 - 1;
}
if( v10 < v13 )
goto LABEL_103;
}
}
v61 = *((_DWORD *)v12 + 2);
v15 = (char *)MmGetPfnDb() + 40;
if( v6 != v8 )
{
v16 = v6 + 34;
v17 = &v15[v4];
do
{
if( v9 > 0xFFFFFFFFFi64 )
return 0i64;
if( ((*(_QWORD *)v17 >> 50) & 1) == 0 )
return 0i64;
v18 = *(_QWORD *)(v16 + 6);
if( *(UINT16 **)(qword_140C4E388 + 8 * ((v18 >> 39) & 0x3FF)) != v5
|| (*(_BYTE *)v16 & 7u) > 1
|| (v18 & 0x1000000000i64) != 0 )
{
return 0i64;
}
v16 += 48i64;
++v9;
v17 += 48;
}
while( v16 - 34 != v8 );
}
Lock = v5 + 96;
v19 = v3;
*(_OWORD *)&LockHandle.WorkItem.Parameter = 0i64;
LODWORD(v20) = KeAbPreAcquire(v5 + 96, 0i64, 1ui64);
v21 = v20;
if( _InterlockedCompareExchange64((volatile signed __int64 *)Lock, 17i64, 0i64)
&& !ExfTryAcquirePushLockShared((UINT64 *)Lock) )
{
if( v21 )
KeAbPostReleaseEx(Lock, v21);
return 0i64;
}
if( v21 )
v21[26] |= 1u;
v23 = v6;
if( v6 == v8 )
goto LABEL_49;
v24 = (_QWORD *)((char *)MmGetPfnDb() + v4 + 40);
while( 1 )
{
if( v23 == v2 )
{
v25 = (UINT64 *)(v23 + 16);
if( (*(_BYTE *)(v23 + 34) & 7) != 0 )
MiSetOriginalPtePfnFromFreeList(v25);
else
*v25 &= 0xFFFFFFFFFFFFFC1Fui64;
goto LABEL_48;
}
if( v19 > 0xFFFFFFFFFi64
|| ((*v24 >> 50) & 1) == 0
|| *(UINT16 **)(qword_140C4E388 + 8 * ((*(_QWORD *)(v23 + 40) >> 39) & 0x3FFi64)) != v63
|| (*(_BYTE *)(v23 + 34) & 7u) > 1
|| _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) )
{
goto LABEL_73;
}
if( (*(_BYTE *)(v23 + 34) & 7u) > 1 )
goto LABEL_72;
v26 = *(_QWORD *)(v23 + 40);
if( *(UINT16 **)(qword_140C4E388 + 8 * ((v26 >> 39) & 0x3FF)) != v63
|| (*(_BYTE *)(v23 + 35) & 0x40) != 0
|| (v26 & 0x1000000000i64) != 0 )
{
goto LABEL_72;
}
if( !MiUnlinkFreeOrZeroedPage(v19, 0i64, 0i64) )
break;
++*((_DWORD *)&LockHandle.WorkItem.Parameter + ((unsigned __int64)*(unsigned __int8 *)(v23 + 34) >> 6));
LABEL_48:
v23 += 48i64;
++v19;
v24 += 6;
if( v23 == v8 )
goto LABEL_49;
}
MiReturnFreeZeroPage(v23);
LABEL_72:
_InterlockedAnd64((volatile signed __int64 *)(v23 + 24), 0x7FFFFFFFFFFFFFFFui64);
LABEL_73:
if( v23 == v8 )
{
LABEL_49:
v27 = 0;
v28 = 1;
do
{
v29 = v7 + 1;
v30 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v29);
v31 = v7 + 2;
v32 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v31);
v33 = v7 + 3;
v34 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v33);
v35 = v30;
v36 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v7);
v37 = v32;
v38 = v7;
v39 = v36;
if( v27 >= v36 )
v39 = v27;
if( v39 >= v30 )
v35 = v39;
if( v35 >= v32 )
v37 = v35;
v40 = v27 < v36;
v27 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v33);
if( !v40 )
v38 = v28;
v28 = v7 + 3;
if( v39 >= v30 )
LODWORD(v29) = v38;
if( v35 >= v32 )
LODWORD(v31) = v29;
if( v37 >= v34 )
v28 = v31;
v7 += 4;
if( v37 >= v34 )
v27 = v37;
}
while( v7 < 4 );
v41 = v60;
v42 = 0;
v43 = v66;
v44 = v28;
if( v60 != 1 )
{
while( 1 )
{
v23 -= 48i64;
if( MiPfnZeroingNeeded(v23, v28) )
break;
if( v23 == v66 )
goto LABEL_80;
}
v60 = 1;
v41 = 1;
}
LABEL_80:
v45 = 1;
v59 = 1;
if( v41 != 1 )
{
if( (unsigned int)MiColdPageSizeSupported() )
v45 = 0;
v59 = v45;
}
v46 = v66 + 720;
v47 = 0;
v48 = v66 + 720;
for( i = 0; i < 0x10; ++i )
{
if( *(unsigned __int8 *)(v48 + 34) >> 6 != v28 )
{
MiChangePageAttribute(v48, v28, 1);
v45 = v59;
}
if( !v45 )
{
v50 = *(_QWORD *)(v48 + 16);
if( qword_140C4DC80 && (v50 & 0x10) == 0 )
v50 &= ~qword_140C4DC80;
if( HIDWORD(v50) != 4294967293 )
v47 = 1;
}
*(_QWORD *)(v48 + 16) = 0i64;
v48 -= 48i64;
}
v51 = v67;
v65 = 0i64;
a1[1] = v60;
LODWORD(v58) = 1;
LODWORD(v56) = v45;
a1[0] = v67;
v52 = *((_QWORD *)v63 + 2) + 4544i64 * v61;
HIDWORD(a1[1]) = 2;
LOBYTE(v65) = 17;
MiInitializeAllResidentPageBasePfns(v63, v67, 16i64, 2i64, v44, v56, v58);
LODWORD(v57) = 1;
MiCreateInitialLargeLeafPfns(v67, 16i64, 2i64, v44, *v63, v57);
LockHandle.WorkItem.List.Flink = 0i64;
LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)(v52 + 4328);
KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)(v52 + 4328), v53, v54);
v55 = v68;
do
{
if( v46 == v43 )
MiInsertLargePageInNodeList((INT64)a1);
if( v46 != v55 )
_InterlockedAnd64((volatile signed __int64 *)(v46 + 24), 0x7FFFFFFFFFFFFFFFui64);
++v42;
v46 -= 48i64;
}
while( v42 < 0x10 );
KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
if( v47 )
MiChangePageHeatImmediate(v51, 2i64, 0i64);
MiReleasePushLockUnordered((volatile INT64 *)v63 + 24);
return 1i64;
}
for( ; v6 < v23; v6 += 48i64 )
{
if( v6 != v2 )
{
MiReturnFreeZeroPage(v6);
_InterlockedAnd64((volatile signed __int64 *)(v6 + 24), 0x7FFFFFFFFFFFFFFFui64);
}
}
MiReleasePushLockUnordered((volatile INT64 *)Lock);
return 0i64;
}Referenced by:
MiInsertPageInFreeOrZeroedList